Establish certifiable Voting provider boundary

docs/VOTING_DOMAIN.md

@@ -32,6 +32,12 @@ credentials inside its own assurance boundary and returns aggregate counts,
 weighted counts, a result hash, and evidence. GovOPlaN does not claim that a
 provider or deployment satisfies legal or certification requirements merely
 because the adapter contract is implemented.
+Each provider declares supported assurance profiles, protocol and
+implementation identity, and certification state. Voting pins that declaration
+when opening and revalidates it before provider casting and finalization.
+`external_certified` requires a current authority, certificate reference,
+evidence reference, and validity window; a changed, expired, or revoked claim
+fails closed.
 Core bounds provider evidence to JSON, 64 items and 64 KiB and rejects fields
 that can carry credentials, private key material, plaintext, or raw
 selections before Voting or Committee can persist the projection.
@@ -57,6 +63,14 @@ external certification. It therefore cannot be selected for `secret` or
 the ballot opens; externally hosted providers may continue to require a
 pre-existing reference.
 
+POLYAS is the selected first external provider, initially through an explicit
+operator-assisted handoff until a contracted API and sandbox are available.
+The historical POLYAS CORE 2.5 Common Criteria certificate expired on
+2026-06-24, so its reference alone cannot enable `external_certified`. See
+[the POLYAS provider profile](POLYAS_PROVIDER_PROFILE.md). Native certifiable
+development is governed by the separate
+[certifiable Voting program](CERTIFIABLE_VOTING_PROGRAM.md).
+
 ## Lifecycle and concurrency
 
 Ballots move through `draft -> open -> closed -> certified`. A closed or
@@ -109,4 +123,7 @@ node-local filesystem.
 - raw selections are never returned by list, detail, result, or history APIs
 - provider result keys must exactly match frozen options
 - external results require evidence and cannot exceed the frozen electorate
+- external providers must match the assurance declaration frozen at opening
+- externally certified providers must remain currently certified through
+  provider casting and finalization
 - certification and annulment use separate permissions